build-firmware.yml

name: Build firmware

# Builds the Debian 13 (Proxmox VE 9) build-env image, pushes it to GHCR, then
# rebuilds the OVMF CODE images with the custom logo committed at assets/logo.png.
# On a v* tag push the .fd files are attached to a GitHub Release.

on:
  push:
    branches: [main]
    tags: ["v*"]
  workflow_dispatch:
    inputs:
      logo:
        description: "Path to the logo image in the repo"
        default: "assets/logo.png"
        required: false

concurrency:
  group: build-firmware-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # 1) Build and publish the reusable build environment image to GHCR.
  image:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      name: ${{ steps.name.outputs.name }}
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v7

      - name: Compute image name (lowercase)
        id: name
        run: echo "name=ghcr.io/${GITHUB_REPOSITORY,,}/build-env" >> "$GITHUB_OUTPUT"

      - uses: docker/setup-buildx-action@v4

      - name: Log in to GHCR
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker metadata
        id: meta
        uses: docker/metadata-action@v6
        with:
          images: ${{ steps.name.outputs.name }}
          tags: |
            type=ref,event=branch
            type=ref,event=tag
            type=sha
            type=raw,value=latest,enable={{is_default_branch}}

      - name: Build and push build-env image
        id: build
        uses: docker/build-push-action@v7
        with:
          context: docker
          file: docker/Dockerfile
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  # 2) Build the OVMF firmware inside the freshly pushed image.
  firmware:
    needs: image
    runs-on: ubuntu-latest
    timeout-minutes: 120
    permissions:
      contents: write # create the GitHub Release on tags
      packages: read # pull the build-env image
    container:
      image: ${{ needs.image.outputs.name }}@${{ needs.image.outputs.digest }}
      credentials:
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}
    env:
      LOGO: ${{ github.event.inputs.logo || 'assets/logo.png' }}
      # ccache speeds up the EDK2 C compilation across runs. The build-env image
      # puts /usr/lib/ccache first on PATH, so gcc / i686-linux-gnu-gcc resolve to
      # ccache masquerade symlinks transparently.
      CCACHE_DIR: ${{ github.workspace }}/.ccache
      CCACHE_MAXSIZE: "500M"
      # The build tree lives under a stable workspace path; BASEDIR lets ccache
      # treat absolute paths as relative so hits survive across runs/runners.
      CCACHE_BASEDIR: ${{ github.workspace }}
      # OVMF embeds __DATE__/__TIME__ in a few objects; without this ccache would
      # refuse to cache them. Accept slightly stale build timestamps for cache hits.
      CCACHE_SLOPPINESS: time_macros
    steps:
      - uses: actions/checkout@v7

      # Rotate weekly so the cached firmware source stays reasonably current.
      # Bump this expression (or clear caches) to force a fresh upstream clone.
      - name: Compute weekly cache key
        id: ck
        run: echo "week=$(date -u +%Y%V)" >> "$GITHUB_OUTPUT"

      # Cache the cloned pve-edk2-firmware checkout + its ~36 submodules (~1.8 GB).
      # On a hit, build-firmware.sh sees the existing .git and skips the clone,
      # the fetch/pull, and the submodule download entirely.
      - name: Cache pve-edk2-firmware source + submodules
        uses: actions/cache@v6
        with:
          path: ${{ github.workspace }}/_build/pve-edk2-firmware
          key: pve-edk2-fw-${{ steps.ck.outputs.week }}

      # Persist the ccache directory across runs. A unique key per run always saves
      # the freshly updated cache; restore-keys pull the most recent prior cache so
      # the next build reuses previously compiled object hashes.
      - name: Cache ccache (EDK2 compile cache)
        uses: actions/cache@v6
        with:
          path: ${{ env.CCACHE_DIR }}
          key: ccache-${{ steps.ck.outputs.week }}-${{ github.run_id }}
          restore-keys: |
            ccache-${{ steps.ck.outputs.week }}-
            ccache-

      # The build-env image already prepends /usr/lib/ccache, but assert it here so
      # ccache wins on PATH for every step regardless of runner PATH ordering.
      - name: Put ccache first on PATH
        run: echo "/usr/lib/ccache" >> "$GITHUB_PATH"

      - name: Build OVMF CODE images with custom logo
        env:
          SKIP_DEPS: "1" # deps are baked into the build-env image
          OVMF_ONLY: "1" # x64 OVMF_CODE_4M(.secboot).fd only
          GIT_URL: https://git.proxmox.com/git/pve-edk2-firmware.git
          GIT_DEPTH: "1" # shallow clone repo + submodules (much faster)
          BUILD_ROOT: ${{ github.workspace }}/_build
        run: bash scripts/build-firmware.sh "$LOGO"

      # Surface hit/miss ratio so cache effectiveness is visible in the run log.
      - name: ccache statistics
        if: always()
        run: ccache -s

      - name: Collect artifacts
        run: |
          set -euo pipefail
          out="${GITHUB_WORKSPACE}/_build/edk2-work/debian/ovmf-install"
          mkdir -p dist
          cp "${out}/OVMF_CODE_4M.fd" dist/
          cp "${out}/OVMF_CODE_4M.secboot.fd" dist/
          ( cd dist && sha256sum ./*.fd | tee SHA256SUMS )

      - name: Upload build artifact
        uses: actions/upload-artifact@v7
        with:
          name: ovmf-custom-logo
          path: dist/
          if-no-files-found: error

      - name: Attach to GitHub Release
        if: startsWith(github.ref, 'refs/tags/')
        uses: softprops/action-gh-release@v3
        with:
          files: |
            dist/OVMF_CODE_4M.fd
            dist/OVMF_CODE_4M.secboot.fd
            dist/SHA256SUMS